FAQ FAQ  Forum Search   Events   Register Register  Login Login

E-mount electronic protocol reverse engineering

Page  <1 34567 14>
Author
Leegong View Drop Down
Newbie
Newbie

Joined: 30 September 2016
Status: Offline
Posts: 25
Post Options Post Options   Quote Leegong Quote  Post ReplyReply Direct Link To This Post Posted: 06 June 2017 at 15:20
@Entropy512,
Yes , debug UART is a separate interface , however it isn't connected
to anything , you may connect it with your own UART terminal .

I'm not able to readback the previous firmware from an adapter(MC-11 or LAEA),
i just analyzed updates of firmware .

I have not looked at the recent update of Sony issued .   
 



Back to Top
Entropy512 View Drop Down
Groupie
Groupie

Joined: 22 July 2015
Country: United States
Status: Offline
Posts: 55
Post Options Post Options   Quote Entropy512 Quote  Post ReplyReply Direct Link To This Post Posted: 06 June 2017 at 23:57
Originally posted by Leegong Leegong wrote:

@Entropy512,
Yes , debug UART is a separate interface , however it isn't connected
to anything , you may connect it with your own UART terminal .

I'm not able to readback the previous firmware from an adapter(MC-11 or LAEA),
i just analyzed updates of firmware .

I have not looked at the recent update of Sony issued .   

Oh, I thought that the LA-EA3 hadn't received an update prior to last week's - Nice to know. It would be very interesting to look at the differences between the old and new firmware.

What CPU is in the MC-11?

A few other things:
Command 0x1D has at least three different modes. The mode is set by the third/fourth bytes of the command payload, the actual motor position (relative or absolute) is in the first two bytes.

Mode 0x0000 - First two bytes are absolute position - probably unsigned but I've never seen a value greater than 32767 so I'm not sure - Pretty much the sole AF command for EA3 with a newer legacy-adapter PDAF body (like A6300), also rare to see anything else when a native lens is in AF-C

Mode 0x3cff (note: I did byteswapping here since everything is little-endian) - First two bytes are a signed twos-complement relative motion command. Only seen so far when a legacy adapter (such as EA3) is in CDAF mode during the microstepping phase of CDAF - this is almost always negative motion
Mode 0x0400 - First two bytes are a signed twos-complement relative motion command - may have a scaling factor not seen with 0x3cff, hard to tell. Appears to be sent as the final relative command in a microstepping sequence. Usually is positive motion but on occasion is negative. I see evidence of partial motor travel (maybe there's a 0.5x scaling factor?) whenever this is sent to an EA3. That said - I've sometimes seen an EA3 not fully move to a commanded absolute position...
Back to Top
Entropy512 View Drop Down
Groupie
Groupie

Joined: 22 July 2015
Country: United States
Status: Offline
Posts: 55
Post Options Post Options   Quote Entropy512 Quote  Post ReplyReply Direct Link To This Post Posted: 07 June 2017 at 00:49
As an FYI, I updated my parser at https://github.com/Entropy512/emount_tools/blob/master/emount_plotdata.py with a whole bunch of additional comments
Back to Top
Dave Micheal View Drop Down
Newbie
Newbie

Joined: 03 August 2017
Status: Offline
Posts: 1
Post Options Post Options   Quote Dave Micheal Quote  Post ReplyReply Direct Link To This Post Posted: 03 August 2017 at 15:26
Seems to me that the number one real-world problem with the e-mount system is that the lenses are left with closed apertures when they are disconnected. It makes using those lenses elsewhere a real pain.

It also looks like your investigation has almost reached the stage where you could write a script for a common micro-controller that could force the aperture open all the way.

As an intermediate goal: It would validate your work and have real-world utility.
Back to Top
sympa View Drop Down
Newbie
Newbie

Joined: 09 August 2015
Country: Netherlands
Status: Offline
Posts: 16
Post Options Post Options   Quote sympa Quote  Post ReplyReply Direct Link To This Post Posted: 14 February 2018 at 19:42
Interesting to see that Commlite have a Nikon-to-Sony adapter and the firmware of that adapter is upgraded via the camera, just like a native Sony lens.

That would be quite a feat of reverse engineering for the sake of saving a USB port. Or would they have bought the software for E-mount from Sony?

Answer: some quick check shows the software to be very similar to the Sony updater. So they must have licensed this from Sony.

Edited by sympa - 14 February 2018 at 20:15
Back to Top
sympa View Drop Down
Newbie
Newbie

Joined: 09 August 2015
Country: Netherlands
Status: Offline
Posts: 16
Post Options Post Options   Quote sympa Quote  Post ReplyReply Direct Link To This Post Posted: 05 March 2018 at 19:23
Another 'discovery' is that Sony has different OSPDAF sensors for different exit pupil distances.

This could be a built-in table or it could be communicated by the lens to the body. The boundaries are at 60 and 110 mm pupil distance.
 



Back to Top
Entropy512 View Drop Down
Groupie
Groupie

Joined: 22 July 2015
Country: United States
Status: Offline
Posts: 55
Post Options Post Options   Quote Entropy512 Quote  Post ReplyReply Direct Link To This Post Posted: 06 March 2018 at 22:54
I've forgotten how to multi-quote here, so I'll just quote the most recent thing I'm replying to. I've been away for a while, might come back to this in the next few weeks.

Originally posted by sympa sympa wrote:

Another 'discovery' is that Sony has different OSPDAF sensors for different exit pupil distances.

This could be a built-in table or it could be communicated by the lens to the body. The boundaries are at 60 and 110 mm pupil distance.

Oh? Interesting - have more info on this? I don't recall seeing anything about this on DPR.

I had assumed that there is at least some sort of optical profiling info reported by the lens that improves behavior of off-axis PDAF sites (most obvious indication of this is how legacy-adapter PDAF misbehaves with many lenses but native lenses don't, and the fact that some Sigma lenses had partial misbehavior on earlier firmware versions.)

As to updating via USB - that would require sniffing at least one update cycle to an adapter/lens, both on the PC side and the mount side. That's waaaay beyond me as far as RE capability.

As to the ability to at least open up an E-mount lens aperture - yeah at this point I could probably whip something up if I had the time. I've been very busy with other stuff lately though...
Back to Top
sympa View Drop Down
Newbie
Newbie

Joined: 09 August 2015
Country: Netherlands
Status: Offline
Posts: 16
Post Options Post Options   Quote sympa Quote  Post ReplyReply Direct Link To This Post Posted: 07 March 2018 at 07:10
Can you read patents on this kind of thing? If so I'll dig up where I found that.

As far as the firmware update: it is clear Commlite licensed it from Sony, as the firmware utility has the same file structure (though different binaries, names and parts are similar. Finding that is more of a statement that things can be licensed and do not have to be RE-ed.
Back to Top
Miranda F View Drop Down
Senior Member
Senior Member

Joined: 11 January 2014
Country: United Kingdom
Location: Bristol
Status: Offline
Posts: 3519
Post Options Post Options   Quote Miranda F Quote  Post ReplyReply Direct Link To This Post Posted: 07 March 2018 at 10:17
Looking at the link in Syber's post in another thread, it does seem likely that at least Sony lenses provide information on the shape/telecentricity of the exit pupil as this affects EFCS.
Miranda F & Sensorex, Sony A58, Nex-6, Dynax 4, 5, 60, 500si/600si/700si/800si, various Sony & Minolta lenses, several Tamrons, lots of MF primes and *far* too many old film cameras . . .
Back to Top
Roboticon View Drop Down
Newbie
Newbie

Joined: 12 May 2018
Country: United States
Location: Santa Barbara
Status: Offline
Posts: 5
Post Options Post Options   Quote Roboticon Quote  Post ReplyReply Direct Link To This Post Posted: 12 May 2018 at 21:56
I hope this will be considered as within the topic of this thread:

I'm looking for information on which pins might be responsible for transmitting "Focus Hold Button-depressed" information to the camera. This button appears on many of the recent Sony brand lenses, particularly the longer telephotos, zooms, and lenses with larger apertures, and it allows the user to maintain focus hold with the hand that is holding the lens - leaving the right hand to control the camera and shutter release.
Does anyone know which (likely two?) pins might transmit this data?
Or perhaps that button press is "a state that is scanned by the cpu" and transmitted within the data stream?
Back to Top
QuietOC View Drop Down
Senior Member
Senior Member

Joined: 28 February 2015
Country: United States
Location: Michigan
Status: Offline
Posts: 2932
Post Options Post Options   Quote QuietOC Quote  Post ReplyReply Direct Link To This Post Posted: 13 May 2018 at 00:01
Originally posted by Roboticon Roboticon wrote:


Does anyone know which (likely two?) pins might transmit this data?

Your answer is in the second post:

[Pin] 7: RXD - Serial data from lens to body

Sony A7III NEX-5T HVL-F45RM LA-EA3 LA-EA4 MB-IV MC-11 EF-E II MD-NEX KR-NEX DA-NEX
Minolta Maxxum 600si
Pentax Q7 5-15 15-45/2.8 8.5/1.9 11.5/9 AF-P/Q
Back to Top
Miranda F View Drop Down
Senior Member
Senior Member

Joined: 11 January 2014
Country: United Kingdom
Location: Bristol
Status: Offline
Posts: 3519
Post Options Post Options   Quote Miranda F Quote  Post ReplyReply Direct Link To This Post Posted: 14 May 2018 at 13:53
Both the lens and the camera contain microprocessors, and data is transmitted serially. There isn't a dedicated pin for each type of data (hasn't been since at least 1985) I don't know which bytes are changed.
Miranda F & Sensorex, Sony A58, Nex-6, Dynax 4, 5, 60, 500si/600si/700si/800si, various Sony & Minolta lenses, several Tamrons, lots of MF primes and *far* too many old film cameras . . .
Back to Top
Roboticon View Drop Down
Newbie
Newbie

Joined: 12 May 2018
Country: United States
Location: Santa Barbara
Status: Offline
Posts: 5
Post Options Post Options   Quote Roboticon Quote  Post ReplyReply Direct Link To This Post Posted: 14 May 2018 at 18:35
Thanks for this information and confirmation of my suspicions. That would make the simple implementation of a 'focus hold' button unlikely, unless a simpler workaround might be thought of, or even possible...
But any focus hold button on a third party accessory or even just a remote button would then need to also integrate its serial data into the stream.
I wonder if Sony's current focus hold button is implemented by being "read" as closed or open, and if this is achieved by the lens cpu sensing its state at regular intervals? (So this might still be a 'simple-ish' button switch, but its state is constantly checked(?))
Many thanks for your inputs!
Back to Top
sympa View Drop Down
Newbie
Newbie

Joined: 09 August 2015
Country: Netherlands
Status: Offline
Posts: 16
Post Options Post Options   Quote sympa Quote  Post ReplyReply Direct Link To This Post Posted: 14 May 2018 at 19:59
It doesn't work that way. How it likely works is that the lens inserts a data packet with the function 'hold focus' (or maybe it is a "switch to MF") into the data stream from the lens to the camera - and the camera follows that command by stopping focusing.

A DIY method might be to disconnect the focus motor, but this will likely just give an error on the side of the camera.

But it doesn't matter whether the switch is NO or NC.
Back to Top
Dyxum main page >  Forum Home > Dyxum Community > Knowledge Base Page  <1 34567 14>

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.063 seconds.

Monitor calibration strip

Dyxum.com - Home of the alpha system photographer

In memory of Cameron Hill - brettania

Feel free to contact us if needed.